Can there be an invasion of privacy in a business environment in this example? Say you have login banners, a signed security policy, and a security awareness program that let the employees know that they shouldn't expect privacy on computers while at work. You suspect an employee has breached your security policy in some way, could you surreptitiously install
Basically, if you have login banners, etc, is there a limit to the things you can monitor without breaking federal laws by wiretapping, possessing passwords, and similar things?
Edit This is according to US law…
Typically, there is "no expectation of privacy." But… California has enacted rules that give workers a bit more privacy on the job. Also, government workers have more privacy rights than civilians on the job.
The reasoning for civilian businesses is that the computers, the data, the bandwidth, etc. belong to the employer. The employer sets the rules for what can and cannot be done with their property. Where business often fall down is when they fail to enforce their policies CONSISTENTLY. There have been numerous lawsuits charging unfair enforcement. "Joe Slacker" may not like it when he's terminated for-cause. The employer needs to be prepared to defend why they singled "Joe" out for special "attention," if their policies do not include a proviso for regular monitoring of all employees or a clearly stated policy of random monitoring.
All things being equal, it sounds like the employer in your scenario is free to monitor BUT please seek the advice of an attorney who specializes in workplace issues.
-Austin
Thanks for your insight!
Be certain to check for civil contractual issues on employee monitoring as well.
I had recent experience in a California corporate environment - one of the "gotchas" to deploying a monitoring solution like Spector was a union contract *requiring* notification to the union of any monitoring of a union member. This came up originally with CCTV monitoring in high theft risk areas, but certainly appled to keylogging as well.
-Jim
I'm glad you mentioned that jemartin, because I wouldn't of though of that. I guess the lesson I'm learning is to let the legal department decide so you can CYA in case things go wrong…